@ship.zone/szci 7.1.5 → 7.1.6

package/changelog.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 2026-07-28 - 7.1.6
+
+### Fixes
+
+- validate npm credentials before publishing (npm)
+  - Validate all SZCI_TOKEN_NPM values before logging or writing .npmrc
+  - Reject malformed registry, encoding, or token values without exposing credential input
+  - Await credential preparation and reuse the validated registry list during npm publish
+- remove duplicate pending npm credential fix entries (changelog)
+  - Consolidate repeated pending fix bullets under the existing npm credential validation entry.
+
 ## 2026-07-28 - 7.1.5
 
 ### Fixes

package/deno.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/szci",
-  "version": "7.1.5",
+  "version": "7.1.6",
   "exports": "./mod.ts",
   "nodeModulesDir": "auto",
   "tasks": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ship.zone/szci",
-  "version": "7.1.5",
+  "version": "7.1.6",
   "description": "Serve Zone CI - A tool to streamline Node.js and Docker workflows within CI environments, particularly GitLab CI, providing various CI/CD utilities. Powered by Deno with standalone executables.",
   "keywords": [
     "Node.js",

package/readme.md

@@ -199,6 +199,9 @@ SZCI_TOKEN_NPM_1="registry.npmjs.org|dGhlLXRva2VuLWhlcmU="
 SZCI_TOKEN_NPM_2="verdaccio.example.com|the-token-here|plain"
 ```
 
+SZCI validates every configured npm credential before writing `.npmrc`. Malformed
+registry, encoding, or token values fail without logging the credential.
+
 ### SSH Keys
 
 Pipe-delimited format: `host|privKeyBase64|pubKeyBase64`

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@ship.zone/szci',
-  version: '7.1.5',
+  version: '7.1.6',
   description: 'Serve Zone CI - A tool to streamline Node.js and Docker workflows within CI environments, particularly GitLab CI, providing various CI/CD utilities. Powered by Deno with standalone executables.'
 }

package/ts/manager.npm/index.ts

@@ -4,6 +4,11 @@ import * as paths from '../szci.paths.ts';
 import { logger } from '../szci.logging.ts';
 import { bash, bashNoError, nvmAvailable } from '../szci.bash.ts';
 import { Szci } from '../szci.classes.szci.ts';
+import {
+  type INpmCredential,
+  parseNpmCredentialEnvironment,
+  validateNpmRegistryUrl,
+} from './npmcredential.ts';
 
 export class SzciNpmManager {
   public szciRef: Szci;
@@ -42,7 +47,7 @@ export class SzciNpmManager {
     } else {
       logger.log(
         'info',
-        `>>szci npm ...<< cli arguments invalid... Please read the documentation.`
+        `>>szci npm ...<< cli arguments invalid... Please read the documentation.`,
       );
       Deno.exit(1);
     }
@@ -51,66 +56,55 @@ export class SzciNpmManager {
   /**
    * authenticates npm with token from env var
    */
-  public async prepare() {
+  public async prepare(): Promise<INpmCredential[]> {
     logger.log('info', 'running >>npm prepare<<');
     const config = this.szciRef.szciConfig.getConfig();
-    let npmrcFileString: string = '';
-    await plugins.smartobject.forEachMinimatch(
+    const npmCredentials = parseNpmCredentialEnvironment(
       Deno.env.toObject(),
-      'SZCI_TOKEN_NPM*',
-      (npmEnvArg: string) => {
-        if (!npmEnvArg) {
-          logger.log('note','found empty token...');
-          return;
-        }
-        const npmRegistryUrl = npmEnvArg.split('|')[0];
-        logger.log('ok', `found token for ${npmRegistryUrl}`);
-        let npmToken = npmEnvArg.split('|')[1];
-        if (npmEnvArg.split('|')[2] && npmEnvArg.split('|')[2] === 'plain') {
-          logger.log('ok', 'npm token not base64 encoded.');
-        } else {
-          logger.log('ok', 'npm token base64 encoded.');
-          npmToken = plugins.smartstring.base64.decode(npmToken);
-        }
-        npmrcFileString += `//${npmRegistryUrl}/:_authToken="${npmToken}"\n`;
-      }
     );
-    logger.log('info', `setting default npm registry to ${config.npmRegistryUrl}`);
-    npmrcFileString += `registry=https://${config.npmRegistryUrl}\n`;
+    if (npmCredentials.length === 0) {
+      throw new Error('No SZCI_TOKEN_NPM credentials were provided.');
+    }
 
-    // final check
-    if (npmrcFileString.length > 0) {
-      logger.log('info', 'found one or more access tokens');
-    } else {
-      logger.log('error', 'no access token found! Exiting!');
-      Deno.exit(1);
+    let npmrcFileString: string = '';
+    for (const npmCredential of npmCredentials) {
+      logger.log('ok', `found token for ${npmCredential.registryUrl}`);
+      logger.log(
+        'ok',
+        npmCredential.tokenEncoding === 'plain'
+          ? 'npm token not base64 encoded.'
+          : 'npm token base64 encoded.',
+      );
+      npmrcFileString += `//${npmCredential.registryUrl}/:_authToken="${npmCredential.token}"\n`;
     }
 
+    const defaultRegistryUrl = validateNpmRegistryUrl(config.npmRegistryUrl);
+    logger.log('info', `setting default npm registry to ${defaultRegistryUrl}`);
+    npmrcFileString += `registry=https://${defaultRegistryUrl}\n`;
+    logger.log('info', 'found one or more access tokens');
+
     // lets save it to disk
     plugins.smartfile.memory.toFsSync(npmrcFileString, '/root/.npmrc');
 
     // lets set the cache directory
     await bash(`npm config set cache ${paths.SzciCacheDir}  --global `);
 
-    return;
+    return npmCredentials;
   }
 
   /**
    * publish a package to npm
    */
   public async publish() {
-    const buildPublishCommand = async () => {
+    const buildPublishCommand = async (
+      npmCredentialsArg: INpmCredential[],
+    ) => {
       let npmAccessCliString = ``;
       let npmRegistryCliString = ``;
       let publishVerdaccioAsWell = false;
       const config = this.szciRef.szciConfig.getConfig();
-      const availableRegistries: string[] = [];
-      await plugins.smartobject.forEachMinimatch(
-        Deno.env.toObject(),
-        'SZCI_TOKEN_NPM*',
-        (npmEnvArg: string) => {
-          availableRegistries.push(npmEnvArg.split('|')[0]);
-        }
+      const availableRegistries = npmCredentialsArg.map(
+        (npmCredentialArg) => npmCredentialArg.registryUrl,
       );
 
       // -> configure package access level
@@ -140,13 +134,14 @@ export class SzciNpmManager {
         if (verdaccioRegistry) {
           logger.log(
             'info',
-            `package is public and verdaccio registry is specified. Also publishing to Verdaccio!`
+            `package is public and verdaccio registry is specified. Also publishing to Verdaccio!`,
           );
-          publishCommand = `${publishCommand} && npm publish ${npmAccessCliString} --registry=https://${verdaccioRegistry}`;
+          publishCommand =
+            `${publishCommand} && npm publish ${npmAccessCliString} --registry=https://${verdaccioRegistry}`;
         } else {
           logger.log(
             'error',
-            `This package should also be published to Verdaccio, however there is no Verdaccio registry data available!`
+            `This package should also be published to Verdaccio, however there is no Verdaccio registry data available!`,
           );
         }
       }
@@ -155,7 +150,7 @@ export class SzciNpmManager {
 
     // -> preparing
     logger.log('info', `now preparing environment:`);
-    this.prepare();
+    const npmCredentials = await this.prepare();
     await bash(`npm -v`);
     await bash(`pnpm -v`);
 
@@ -173,7 +168,7 @@ export class SzciNpmManager {
 
     // -> publish it
     logger.log('info', `now invoking npm to publish the package!`);
-    await bash(await buildPublishCommand());
+    await bash(await buildPublishCommand(npmCredentials));
     logger.log('success', `Package was successfully published!`);
   }
 

package/ts/manager.npm/npmcredential.ts

@@ -0,0 +1,91 @@
+import * as plugins from './mod.plugins.ts';
+
+export interface INpmCredential {
+  registryUrl: string;
+  token: string;
+  tokenEncoding: 'base64' | 'plain';
+}
+
+const invalidCredentialError = () =>
+  new Error(
+    'Invalid SZCI_TOKEN_NPM credential. Expected registry|token[|plain].',
+  );
+
+const registryUrlRegex = /^[A-Za-z0-9](?:[A-Za-z0-9.-]*[A-Za-z0-9])?(?::[0-9]{1,5})?$/;
+const unsafeTokenRegex = /[\u0000-\u001f\u007f"\\]/;
+
+export const validateNpmRegistryUrl = (registryUrlArg: string): string => {
+  if (
+    !registryUrlArg ||
+    registryUrlArg.length > 512 ||
+    !registryUrlRegex.test(registryUrlArg)
+  ) {
+    throw invalidCredentialError();
+  }
+  return registryUrlArg;
+};
+
+export const parseNpmCredential = (
+  npmEnvironmentValueArg: string,
+): INpmCredential => {
+  const fields = npmEnvironmentValueArg.split('|');
+  if (fields.length < 2 || fields.length > 3) {
+    throw invalidCredentialError();
+  }
+
+  const registryUrl = validateNpmRegistryUrl(fields[0]);
+  const encodedToken = fields[1];
+  const encodingMarker = fields[2];
+  if (
+    !encodedToken ||
+    (encodingMarker !== undefined && encodingMarker !== 'plain')
+  ) {
+    throw invalidCredentialError();
+  }
+
+  let token: string;
+  let tokenEncoding: INpmCredential['tokenEncoding'];
+  if (encodingMarker === 'plain') {
+    token = encodedToken;
+    tokenEncoding = 'plain';
+  } else {
+    if (!plugins.smartstring.base64.isBase64(encodedToken)) {
+      throw invalidCredentialError();
+    }
+    token = plugins.smartstring.base64.decode(encodedToken);
+    if (plugins.smartstring.base64.encode(token) !== encodedToken) {
+      throw invalidCredentialError();
+    }
+    tokenEncoding = 'base64';
+  }
+
+  if (
+    !token ||
+    token.length > 65536 ||
+    unsafeTokenRegex.test(token) ||
+    token.includes('${')
+  ) {
+    throw invalidCredentialError();
+  }
+
+  return {
+    registryUrl,
+    token,
+    tokenEncoding,
+  };
+};
+
+export const parseNpmCredentialEnvironment = (
+  environmentArg: Record<string, string>,
+): INpmCredential[] => {
+  const credentialValues = Object.entries(environmentArg)
+    .filter(([environmentVariableNameArg]) =>
+      environmentVariableNameArg.startsWith('SZCI_TOKEN_NPM')
+    )
+    .sort(([environmentVariableNameA], [environmentVariableNameB]) =>
+      environmentVariableNameA.localeCompare(environmentVariableNameB)
+    )
+    .map(([, environmentVariableValueArg]) => environmentVariableValueArg);
+
+  return credentialValues.map((credentialValueArg) => parseNpmCredential(credentialValueArg));
+};